Security tips
How holes get in, how we clean them, and what to update. Written by the people who maintain the sites.
What a malware scan actually checks – and what it misses
You run a scan, it says everything looks clean, and you breathe out a little. Fair enough. That’s how these tools are...Read More...
Read more September 17, 2026An unapproved event comment could take over WordPress – update The Events Calendar
A stranger leaves a comment on an event page. You never approve it. It sits in moderation, invisible to normal visitors, while...Read More...
Read more September 17, 2026Leftover installers, coming-soon pages, and phpinfo files attackers still find
You’d be surprised what attackers still find on small business websites. Not fancy zero-day stuff. Not movie hacker nonsense. Just forgotten junk...Read More...
Read more September 15, 2026Securing WordPress When You Take Payments on Your Online Shop
If your WordPress site takes payments, the stakes go up fast. A normal brochure site getting hacked is bad enough. An online...Read More...
Read more September 11, 2026WordPress now checks plugin updates before they reach your site
A plugin update appears in your WordPress dashboard a little later than expected. Usually, delay sounds bad. This time it may mean...Read More...
Read more September 10, 2026What Is XML-RPC in WordPress and Should You Disable It? (xmlrpc.php Explained)
XML-RPC is an older way for apps to talk to your WordPress site, but bots use it too. Here's how to check whether you need it and how…
Read more September 8, 2026Same Theme, Different Risk: PHP Version, Plugin Pile, and File Permissions
You can have two WordPress sites using the exact same theme and still end up with very different security problems. That catches...Read More...
Read more September 3, 2026How to safely give a developer access without losing control
You hire a developer because something needs fixing. The checkout is broken. The contact form stopped sending. Your homepage suddenly looks weird...Read More...
Read more September 2, 2026The WordPress attack that waits for you to restore a backup
Imagine an attacker leaves two odd little packages on your WordPress site today. Nothing dramatic happens. The shop keeps taking orders, the...Read More...
Read more September 1, 2026When WordPress isn’t the entry point – lessons from a control-panel breach
Most WordPress security advice starts inside WordPress. Update plugins, remove old administrators, scan the files. Fair enough. But sometimes WordPress isn’t the...Read More...
Read more September 1, 2026File permissions on WordPress: when 775 quietly becomes a backdoor
You can do alot of WordPress security stuff right. Strong password. Updates done. Two-factor on. And still get burned by something boring...Read More...
Read more August 27, 2026The “install Wordfence and forget it” trap
A lot of small business owners do this. They install a security plugin, see a few green checkmarks, maybe get an email...Read More...
Read more